Comment by Retro_Dev | Hacker News Reader

Comment by Retro_Dev | Hacker News Reader

> Distillation attacks, in which attackers use thousands of fake accounts to extract a model’s capabilities at industrial scale, create safety and national security risks. Distillation allows bad actors to create highly capable models without the safeguards we build into Claude. Our September 2026 threat intelligence report details the illicit distillation activity we’ve detected and disrupted so far.

Such a negative tone they put on this. Distillation is amazing, because it means anthropic and openai fail to keep a monopoly. Who even are they who claim it's unethical? If it is truly unethical, then so is the mass data scraping they do on my personal website on a regular basis (without my consent), and all the unauthorized use of content produced by authors, blog writers, wikipedia contributors, and creators everywhere. If it is truly unethical, then anthropic, openai, meta, google... all these companies should have deleted their LLMs long ago. This wording disgusts me.

Heck, it would be amazing if we had more models without guardrails - some of the models that are produced via heretic[1] are actually quite nice to use - in particular, I've enjoyed investigating Chinese censorship by interacting with an abliterated model of Qwen3.8-27b. If security is really a concern, then secure your systems - don't attempt to dumb-down the tools we use. If someone breaks your window, then they are responsible, not the hammer they use to do so.

[1]: https://github.com/p-e-w/heretic

I'm confused how they have been able to create so much public negative perception around distillation. It seems pretty clear that they are the only ones who lose out, and everyone else benefits. I don't have any ethical issues with it, nor is it illegal: at worst it's a ToS violation.

IMO the biggest problem with distillation is that not enough people are openly doing it. I would love to see more small, competitive US labs instead of having the eggs in 2~4 baskets (depending on how you count).

The issue with distillation is: one lab spends $$$ on bleeding edge R&D and expensive RL runs to improve capabilities, and other labs just yoink the raw reasoning traces and mid-train/post-train on them to get 90% of the way there for a small fraction of the cost.

An even smaller fraction of the cost if they do it by buying AI access at as much of a discount as they can find, including black market resellers, and then reselling that access to paying users again with a proxy. As is common.

This gives ruthless "fast followers" an economic edge over the innovator that's putting in the real work.

The dynamics are very much alike to what patents and copyright law are supposed to prevent. Same type of "we took the products of your work and used them to undercut you". Except there are no laws against distillation - so most of the enforcement happens on model provider level.

I'm fine if they put preventative measures in place to protect their work. They already do so. I am NOT fine with their mass manipulation of public opinion to fuel an entirely hypocritical viewpoint. Like, any argument here is hypocritical - but they aren't saying what is REALLY HAPPENING ("distillation steals our work and reduces our profits"), and are actually saying words that make other people fight their battle ("national security", etc).

There's an implication that other companies are improving because they're scraping Anthropic, not because they're investing in better architecture, compute efficiency, or their own synthetic data pipelines. I often see Chinese labs' progress dismissed as "they just distilled Anthropic" and I find it hard to reconcile that with all of the interesting research and open-source tooling that they release.

Is there actually that much capability transfer from non-logit-matched distillation, or is Anthropic just another unwilling source of data?

There is, in fact, "that much capability transfer from non-logit-matched distillation".

Even the early papers on distillation techniques found that surprisingly small distillation datasets can improve task performance noticeably on some specific task types - and that valuable adaptations like SFT/RLHF instruction following can be distilled from one-hot non-logit traces.

A big part of what distillation really gets you is: paving over the mismatch between pre-training and final performance. A base model is trained to spit out fitting text, but not to instruction follow, reason autoregressively, self-check or use tool calls - like an AI has to. There is transfer straight from the "text prediction" pre-training objective, and pre-training sets the foundation for all that follows - but the capabilities you get "out of the box" with it are often unrefined and fragile. Which makes some sense - internet text doesn't often include raw chain-of-thought autoregressive reasoning. It's not the kind of thing humans tend to write.

Reasoning traces? They let an AI learn proven techniques and adaptations directly, from an AI that was already taught "how to be an AI" in other ways.

It's why this kind of distillation typically plugs into mid-training and post-training, not pre-training.

Now, I'm not saying that all Chinese companies do is eat tokens, distill and lie. That just isn't the case. They developed or refined numerous training techniques and architectural adaptations - like deep fusion for high performance visual input, RLVR with GRPO, trunked MoE, storage-efficient and bandwidth-efficient attention formulations, or residual routing techniques like AttnRes. Some of those are used widely now, and some are still on the uptake but show good promise.

But Chinese labs are enjoying massive efficiency gains from being able to distill from the frontier instead of doing things the hard way. It's a leg up. It lets them put their supply of R&D effort and RL compute elsewhere. They wouldn't be nearly as advanced if they couldn't do it.

Thanks, this is interesting and there were multiple things I didn't know here.

> one lab spends $$$ on bleeding edge R&D and expensive RL runs to improve capabilities, and other labs just yoink the raw reasoning traces and mid-train/post-train on them to get 90% of the way there for a small fraction of the cost.

"You're trying to kidnap what I've rightfully stolen."

> The issue with distillation is: one lab spends $$$ on bleeding edge R&D and expensive RL runs to improve capabilities

The issue is doing.. exactly what OpenAI and Anthropic have done to get where they are?

No, there is no issue.

This is a great post and I agree with you on the issues with distillation. I do still feel it's ironic for an AI lab.

As long as labs do not heavily kneecap model outputs, practically all this applies to the training corpus as well.

AI gives ruthless users of AI a leg up over the people who's data it was trained on. "We took the products of your work and used them to undercut you". It's all the same.

The only way I'd be against distilling would be if AI models became owned by the public who's work is used to create them. Of course the AI labs should be paid well, but these models are a product of the entire world's efforts, not only the labs.

The workarounds used to bypass Anthropic's security measures are quite illegal. They use stolen credit cards, API keys, and accounts. That is only possible in China because any other US/EU lab doing the same would get into massive legal trouble.

That's the moat. Mistral has the capability but not the legal protections.

I'm confused why Chinese access to Anthropic A.I. would need to involve stolen accounts.

Couldn't I simply give a Chinese friend my key on Open router?

Yes but Claude is filtered by the Great Firewall. Anthropic also restricts Chinese access. Their security measures aren't bulletproof but they do catch a substantial amount of those accounts and ban them. That's why PRC labs that distill from Claude need thousands.

Let’s not kid ourselves, Anthropic would be running their own distillation “attacks” too if _they_ were the ones playing catch-up. They’ve already shown as much with their illegal scraping of pirated books ($1.5B settlement).

I say just let them duke it out. After a decade of regulatory capture and enshittification, it’s nice to see some actual competition again.

> Anthropic would be running their own distillation “attacks” too if _they_ were the ones playing catch-up

Probably. But if OpenAI or Anthropic stole your credit card to purchase tokens you could sue them. You won't get a cent from any Chinese labs.

> it’s nice to see some actual competition again.

Competition benefits everyone. But this isn't fair competition. A German startup cannot legally do any of these tactics required to bypass Anthropic/OAI's counter-measures. Which makes EU less competitive and therefore less investment in European AI.

> A German startup cannot legally do any of these tactics required to bypass Anthropic/OAI's counter-measures.

A German startup cannot legally do what Anthropic/OpenAI have done. And neither could Anthropic/OAI themselves. What's your point again?

> What's your point again

I said it in my original comment. That is the moat. The reason frontier AI is a two horse race. European labs cannot gain ground because the only way to do it is illegally.

Your original comment painted it as a China moat against US/EU labs. Completely different from instead being a unique disadvantage to EU labs by which the US labs, among others, aren't really affected.

The European labs are distinctly disadvantaged. US labs scraped the entire internet and downloaded copyrighted works to train their models and just paid a fine. They get 99% of all investment money in AI because of the lead they hold. Chinese labs also scrape the internet, download copyrighted works, and launch massive distillation campaigns using stolen accounts and credit cards. They get full support and funding from the PRC.

Europe gets barely any funding because it is so far behind and cannot use the illegal strategies Chinese labs use to distill Opus/Astra. Mistral cannot compete because the competition is literally breaking every law.

Hah. Anthropic and OpenAI used plenty of similarly illegal workarounds to obtain data to create their first models. If a Chinese company had done that first you'd be here saying

> That is only possible in China because any other US/EU lab doing the same would get into massive legal trouble.

Reply on news.ycombinator.com